KR101858620B1 - Device and method for analyzing javascript using machine learning - Google Patents

Abstract

A device for analyzing javascript is disclosed. The device for analyzing javascript includes a sequence extraction module for dynamically executing JavaScript included in a learning target document to extract a first calling sequence of a JavaScript function and extracting a first feature vector from the first calling sequence, and a classifier learning module for learning a classifier model for determining whether to include a malicious script in the learning target document using the first feature vector. It is possible to detect web pages that include malicious scripts.

Description

TECHNICAL FIELD [0001] The present invention relates to a device and method for analyzing JavaScript using machine learning,

An embodiment according to the concept of the present invention relates to an apparatus and method for analyzing JavaScript using machine learning.

According to an analysis report of AV-TEST, a vaccine product benchmarking testing agency, 47 million new malicious codes, including variants, emerged from 2012 to 2013. Malware authors can easily make variants of malicious code while reusing key code for malicious behavior.

Vaccine companies are analyzing thousands of new malicious codes by using signature-based detection methods. The vaccine company extracts the inherent characteristics of the malicious code from the instruction code and / or binary code of the malicious code, and generates and stores the signature in the database.

On the other hand, malicious codes using polymorphism and metamorphism techniques can easily bypass signature-based malware detection techniques. In order to extract the signature of such malicious codes, the malicious code analyzer can perform unpacking and obfuscation decoding . Signature-based detection techniques require that analysts constantly update their databases, detect malicious code in the event of a zero-day attack, use some malicious code or change the entire malicious code There is a problem that the detection rate drops.

Therefore, it is necessary to detect and classify malicious codes that can detect and classify malicious code as a new approach to overcome limitations of signature-based malicious code detection technique.

United States Patent No. 9,438,622 U.S. Patent No. 9,282,117

Disclosure of Invention Technical Problem [8] The present invention provides a device and method for analyzing JavaScript using machine learning capable of detecting a web page including a malicious script through analyzing a call sequence of a JavaScript function.

The apparatus for analyzing JavaScript according to an embodiment of the present invention extracts a first call sequence of a JavaScript function by dynamically executing a JavaScript included in a learning target document and extracts a first feature vector from the first call sequence And a classifier learning module for learning a classifier model for determining whether to include malicious script in the learning target document using the first feature vector.

A JavaScript analysis method according to an embodiment of the present invention includes a learning step and an analysis step and is performed in a JavaScript analysis apparatus, and the learning step includes a sequence extraction module included in the JavaScript analysis apparatus Extracting a first call sequence of the JavaScript function by dynamically executing the JavaScript in the first call sequence, extracting a first feature vector from the first call sequence, Learning module learns a classifier model that determines whether or not a malicious script is included in the learning target document using the first feature vector, and the analyzing step includes: the sequence extracting module Extracts a second call sequence of the JavaScript function, Extracting a second feature vector from a second call sequence and determining whether the malicious script is included in the analysis target document using the classifier model in which the classification module included in the JavaScript analysis apparatus learned, Wherein the learning target document and the analysis target document are HTML documents.

According to the apparatus and method for analyzing JavaScript using machine learning according to the embodiment of the present invention, it is possible to identify a hidden risk script regardless of the obfuscation method of the script and to detect a web page including the malicious script It is effective.

Further, according to the present invention, since the invocation sequence of the JavaScript function actually used is analyzed rather than an explicit script, it is effective to cope with the variant script attack effectively.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In order to more fully understand the drawings recited in the detailed description of the present invention, a detailed description of each drawing is provided.
1 is an exemplary hardware block diagram of a JavaScript analysis apparatus according to an embodiment of the present invention.
2 is a functional block diagram of the JavaScript analysis apparatus shown in FIG.
FIG. 3 is a flowchart illustrating a method of analyzing JavaScript performed by the JavaScript analyzing apparatus shown in FIG. 2. FIG.

It is to be understood that the specific structural or functional description of embodiments of the present invention disclosed herein is for illustrative purposes only and is not intended to limit the scope of the inventive concept But may be embodied in many different forms and is not limited to the embodiments set forth herein.

The embodiments according to the concept of the present invention can make various changes and can take various forms, so that the embodiments are illustrated in the drawings and described in detail herein. It should be understood, however, that it is not intended to limit the embodiments according to the concepts of the present invention to the particular forms disclosed, but includes all modifications, equivalents, or alternatives falling within the spirit and scope of the invention.

The terms first, second, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms may be named for the purpose of distinguishing one element from another, for example, without departing from the scope of the right according to the concept of the present invention, the first element may be referred to as a second element, The component may also be referred to as a first component.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that no other element exists in between. Other expressions that describe the relationship between components, such as "between" and "between" or "neighboring to" and "directly adjacent to" should be interpreted as well.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms "comprises" or "having" and the like are used to specify that there are features, numbers, steps, operations, elements, parts or combinations thereof described herein, But do not preclude the presence or addition of one or more other features, integers, steps, operations, components, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the meaning of the context in the relevant art and, unless explicitly defined herein, are to be interpreted as ideal or overly formal Do not.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings attached hereto.

1 is an exemplary hardware block diagram of a JavaScript analysis apparatus according to an embodiment of the present invention.

1, the JavaScript analysis apparatus 100 includes a communication interface 101, an input interface 103, an output interface 105, a memory 107, a hard disk 109, one or more processors 111, And a system bus / control bus 113. The JavaScript analysis apparatus 100 shown in FIG. 1 may be implemented by a PC (Personal Computer), a server accessible through an Internet network, a notebook computer, or the like.

Briefly, the communication interface 101 is configured to be able to communicate with a device external to the JavaScript analysis device 100. The communication interface 101 is configured to perform wired or wireless communication and includes, for example, a MAC chip that can be connected to a wireless LAN or a wired LAN.

The input interface 103 receives a user input for controlling the JavaScript analysis device 100. The input interface 103 may control the present JavaScript analysis apparatus 100 including a keyboard, a mouse, and the like. For example, the input interface 103 may be configured to select a target document (or target program) to classify as malicious code or a certain family within a particular malicious code class, to start detection and classification of the target document (or target program) May receive user input that may determine termination.

The output interface 105 outputs the processing results detected and classified by the JavaScript analysis apparatus 100. The output interface 105 may be implemented as a display, a speaker, or the like.

Memory 107 includes volatile memory and / or non-volatile memory. The memory 107 stores various data and programs. Volatile memory temporarily stores various data and program segments, and nonvolatile memory can temporarily store various setup data and boot programs necessary for setup or booting.

The hard disk 109 stores various data as a mass storage medium and stores various programs. The hard disk 109 includes at least a program (e.g., a machine learning algorithm) for performing a malicious code classification method for detecting and classifying malicious codes according to the present invention. The hard disk 109 also contains data to be used in the program of the malicious code classification method. Such data may be accessed and managed by a particular program. The data used for malicious code classification and this particular program are preferably configured into a database.

The processor 111 can load the program code of a program stored in the nonvolatile memory or the hard disk 109 and execute the program code. The processor 111 may execute a program for classifying malicious code, a program for training various data used for classification of malicious code, etc., including an execution unit capable of executing an instruction of the program code .

The system bus / control bus 113 is configured to transmit and receive (control) data between each hardware block. The system bus / control bus 113 may be a parallel bus, a serial bus, or the like.

2 is a functional block diagram of the JavaScript analysis apparatus shown in FIG.

1 and 2, the JavaScript analysis apparatus 100 may include at least one of a sequence extraction module 120, a classifier learning module 140, a classification module 160, and a database 180 . The JavaScript analysis apparatus 100 may be implemented by loading program code stored on the hardware shown in Fig. 1 and preferably stored on the hard disk 109 or the like into the processor 111 and controlling each hardware block in accordance with the program code have.

The sequence extraction module 120 executes the JavaScript dynamically to extract a call sequence of the JavaScript function. Specifically, the call sequence can be extracted by dynamically executing JavaScript included in a document received through a predetermined input device or a wired / wireless communication network (e.g., Hypertext Markup Language (HTML) document). The call sequence may be stored in the database 180 by the sequence extraction module 120. At this time, the document may be divided into a learning document for learning of the classifier model and a detection subject document which is the object of classification or detection.

The sequence extraction module 120 can also receive the document from the hard disk 109 via the communication interface 101 or the input interface 103. [

According to an embodiment, the sequence extraction module 120 may extract a feature vector of each extracted call sequence. The feature vector includes a length of a function call sequence, a number of types of functions included in a function call sequence, an entropy of a function call sequence, an N-gram of a function call sequence, and a type of a sub- , The number of sub-sequences, the number of stacks, the type of call stack, the average depth of the call stack (depte), and the maximum depth of the call stack.

In another embodiment, the sequence extraction module 120 extracts the divided call sequence as a feature vector by dividing the extracted call sequence into predetermined lengths, or extracts a value obtained by encoding the divided call sequence in another form as a feature vector You may.

The extracted feature vector may be stored in the DB 180 by the sequence extraction module 120.

The classifier learning module 140 can learn the classifier model using the calling sequence extracted by the sequence extraction module 120 or the calling sequence stored in the DB 180 by the sequence extraction module 120. [

The classifier learning module 140 may classify the classifier model using a feature vector extracted by the sequence extraction module 120 or a feature vector stored in the DB 180 by the sequence extraction module 120 You can learn.

In addition, the classifier learning module 140 may learn the classifier model using a machine learning algorithm. The machine learning algorithm may be implemented in a support vector machine (SVM), a decision tree, a random forest, a naive bayesian, a logistic regression, an artificial neural network a deep neural network, a convolutional neural network, and a recurrent neural network belonging to a neural network and a deep learning sequence algorithm.

The classifier model learned by the classifier learning model 140 may classify the document into at least two or more categories, where the two or more categories may include a set of JavaScripts that contain malicious scripts. According to an embodiment, the learned classifier model may determine whether a malicious script is included in the analysis target JavaScript based on the extracted call sequence or feature vector. For this, the classifier learning model 140 can learn the classifier model by using each call sequence and information about the malicious script and / or the malicious script in each call sequence, And / or information on the malicious script can be received from the hard disk 109 via the communication interface 101 or the input interface 103. [

The classification module 160 can determine whether the malicious script is included in the detection target document or the JavaScript included in the detection target document by using the learned classifier model.

The database 180 may store the call sequence and / or feature vector extracted by the sequence extraction module 120. [

Each of the components of the JavaScript analysis apparatus 100 shown in FIG. 2 is shown as being functionally and logically separable, meaning that each component must be separated into separate physical devices or written in separate codes Or may be easily inferred by an average expert in the field of the present invention.

In this specification, a module may mean a functional and structural combination of hardware for carrying out the technical idea of the present invention and software for driving the hardware. For example, the module may mean a logical unit of a predetermined code and a hardware resource for executing the predetermined code, and does not necessarily mean a physically connected code or a kind of hardware.

FIG. 3 is a flowchart illustrating a method of analyzing JavaScript performed by the JavaScript analyzing apparatus shown in FIG. 2. FIG.

Referring to FIGS. 1 to 3, the JavaScript analysis method mainly includes a learning step of learning a classifier model through analysis of each of a plurality of documents, and a determination step of determining whether malicious script is included in the analysis target document using the learned classifier model And an analysis step.

In the learning step, the sequence extraction module 120 of the JavaScript analysis apparatus 100 extracts the calling sequence of the JavaScript function from each of the plurality of learning target documents (S110). The extracted call sequence may be stored in the DB 180 by the sequence extraction module 120.

According to an embodiment, the learning step may further include a step (S130) in which the sequence extraction module 120 extracts a feature vector from the extracted call sequence. The extracted feature vector may also be stored in the DB 180 by the sequence extraction module 120. Here, the feature vector includes a length of a function call sequence, a number of types of functions included in a function call sequence, an entropy of a function call sequence, an N-gram of a function call sequence, and a sub- The number of sub-sequences, the number of stacks, the type of call stack, the average depth of the call stack (depte), and the maximum depth of the call stack.

The classifier learning module 140 of the JavaScript analysis apparatus 100 can learn the classifier model using the extracted call sequence and / or the extracted feature vectors. The learning of the classifier model includes a machine learning algorithm such as a support vector machine (SVM), a decision tree, a random forest, a naive bayesian, a logistic regression At least one of a deep neural network, a convolutional neural network, and a recurrent neural network belonging to an artificial neural network, deep learning algorithm, Can be used.

In the analysis step, the sequence extraction module 120 extracts a call sequence of the JavaScript function from at least one analysis target document (S310). The extracted call sequence may be stored in the DB 180 by the sequence extraction module 120.

According to an embodiment, the analysis step may further include a step (S330) of extracting a feature vector from the extracted call sequence by the sequence extraction module 120. [ The extracted feature vector may also be stored in the DB 180 by the sequence extraction module 120.

Next, the classification module 160 may determine whether the at least one analysis target document includes malicious script using the learned classifier model (S350).

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

10: JavaScript analysis device
120: sequence extraction module
140: Classifier learning module
160: Classification module
180: DB

Claims (9)

A sequence extraction module for dynamically executing the JavaScript included in the learning target document to extract a first calling sequence of the JavaScript function and extracting a first feature vector from the first calling sequence; And
And a classifier learning module for learning a classifier model for determining whether to include a malicious script in the learning target document using the first feature vector,
Wherein the first feature vector comprises at least one of a length of the first call sequence, a number of types of functions included in the first call sequence, an entropy of the first call sequence, an N-gram of the first call sequence, The number of repetition sub-sequences, the number of call stacks included in the first call sequence, the type of call stack, the average depth of the call stack (e.g., depte) and a maximum depth of the call stack,
Wherein the sequence extraction module extracts the divided calling sequence and further includes the divided calling sequence in the first feature vector by dividing the first calling sequence into a predetermined length,
JavaScript analysis device.
The method according to claim 1,
Wherein the sequence extraction module dynamically executes a document to be analyzed to extract a second calling sequence of a JavaScript function, extract a second characteristic vector from the second calling sequence,
Wherein the JavaScript analysis apparatus further comprises a classification module for determining whether to include malicious script in the analysis target document using the learned classifier model,
JavaScript analysis device.
3. The method of claim 2,
Wherein the learning target document and the analysis target document are HTML (Hypertext Markup Language) documents,
JavaScript analysis device.
delete 3. The method of claim 2,
Wherein the second feature vector comprises a length of the second call sequence, a number of types of functions included in the second call sequence, an entropy of the second call sequence, an N-gram of the second call sequence, The number of repetition sub-sequences, the number of call stacks included in the second call sequence, the type of call stack, the average depth of the call stack (e.g., depte) and a maximum depth of the call stack.
JavaScript analysis device.
The method according to claim 1,
The classifier learning module may be a support vector machine (SVM), a decision tree, a random forest, a naive bayesian, a logistic regression, an artificial neural network learning algorithm using a machine learning algorithm including at least one of a neural network, a deep neural network, a convolutional neural network, and a recurrent neural network.
JavaScript analysis device.
A method for analyzing a JavaScript executed on a JavaScript analyzing apparatus, the method comprising: a learning step and an analyzing step,
In the learning step,
Extracting a first call sequence of a JavaScript function by dynamically executing a JavaScript included in a learning target document by a sequence extraction module included in the JavaScript analysis apparatus;
The sequence extraction module extracting a first feature vector from the first call sequence; And
Wherein the classifier learning module included in the JavaScript analysis apparatus learns a classifier model for determining whether the malicious script is included in the learning target document using the first feature vector,
Wherein the analyzing step comprises:
Extracting a second call sequence of the JavaScript function by dynamically executing the document to be analyzed by the sequence extraction module, and extracting a second feature vector from the second call sequence; And
Determining whether the malicious script is included in the analysis object document using the classifier model in which the classification module included in the JavaScript analysis apparatus learned the classifier model,
Wherein the learning target document and the analysis target document are HTML documents,
Wherein the first feature vector comprises at least one of a length of the first call sequence, a number of types of functions included in the first call sequence, an entropy of the first call sequence, an N-gram of the first call sequence, The number of first call stacks included in the first call sequence, the number of first call stacks included in the first call sequence, the type of the first call stack that is repeatedly executed in the first call sequence, the type of the first repeat sub- An average depth (depte) of the first call stack, and a maximum depth of the first call stack,
Wherein the first feature vector further comprises an extracted partitioned call sequence to the first feature vector by dividing the first call sequence into a predetermined length,
JavaScript analysis method.
8. The method of claim 7,
Wherein the second feature vector comprises a length of the second call sequence, a number of types of functions included in the second call sequence, an entropy of the second call sequence, an N-gram of the second call sequence, The number of the second repetition sub-sequences, the number of the second repetition sub-sequences, the number of the second call stacks included in the second call sequence, the type of the second call stack An average depth (depte) of the second call stack, and a maximum depth of the second call stack.
JavaScript analysis method.
8. The method of claim 7,
The classifier learning module may be a support vector machine (SVM), a decision tree, a random forest, a naive bayesian, a logistic regression, an artificial neural network learning algorithm using a machine learning algorithm including at least one of a neural network, a deep neural network, a convolutional neural network, and a recurrent neural network.
JavaScript analysis method.

Images